Asus RT-AC66U: Guest network clients visible in Windows?

[cyberia]

I have an Asus RT-AC66U router with a guest network enabled. "Access Intranet" setting on the guest network is disabled. However, I am seeing the clients connected to the guest network on my "main" network PCs that are connected to the wired ports. The guest clients are shown in the Network section in Windows Explorer, along with all other wired and wireless devices that are on the main network.

Is that normal? I was under a strong impression that the guest network will have no access to my main network. Why am I seeing the guests in Windows Explorer?

Thanks for any help.

 

[Elixer]

Why wouldn't you see them?
They are broadcasting they are available.

 

[JackMDS]

When you look through your home's Windows you can see people walking in the street.

That does not mean that they can get into your house.

 

[cyberia]

When you look through your home's Windows you can see people walking in the street.

That does not mean that they can get into your house.

Are you saying that even though my Windows PCs see them as belonging to my network, they can't interact with other devices on my network? That's what I want to ensure.

 

[Elixer]

Well, go ahead and open it in explorer, and see what it shows.
If you set it up correctly, you will only see what you told it to show.

 

[XavierMace]

When you look through your home's Windows you can see people walking in the street.

That does not mean that they can get into your house.

Not sure that's the best analogy in this case. Sure, his "window" might be "locked" by needing a username or password but the people are still in his yard. Isn't the whole point of having a guest network to isolate them? If Windows is able to discover PC's on the guest network, that means the networks are bridged.

For example I've got my guest network configured in NAT mode on my Meraki so that they are on an isolated 10.0.0.0/8 network. To access the actual network (which is a separate SSID), you have to either authenticate with an AD account or be manually whitelisted.

 

[cyberia]

Not sure that's the best analogy in this case. Sure, his "window" might be "locked" by needing a username or password but the people are still in his yard. Isn't the whole point of having a guest network to isolate them? If Windows is able to discover PC's on the guest network, that means the networks are bridged.

That's exactly what my concern is. I may be wrong, but I don't have any way to force the guest network to a different subnet. All I can do is set the guest network's "Access Intranet" option to "Disable", but that is not doing the trick.

There is also a "Set AP Isolated" option on the main network to "prevents wireless devices on your network from communicating with each other. This feature is useful if many guests frequently join or leave your network". But won't this also prevent wireless clients on the main network from talking to each other?